Governance, risk and compliance software, and COBIT

A company of any size has to answer three questions. Are we run well? Do we know what could go wrong? Are we following the rules? These are governance, risk and compliance, usually shortened to governance, risk and compliance (GRC). Software has grown up around them, much of it from tools that began as audit software.

For the auditor there is a second side: when a client uses such systems, the auditor needs a framework to judge whether information technology (IT) is under control. The best known is Control Objectives for Information and Related Technologies (COBIT).

This topic covers GRC software, how to choose it, and COBIT 2019 with its principles and components. It also links them to Companies and Allied Matters Act 2020 (CAMA 2020), because the Act puts duties on the audit committee and on the chief executive and chief financial officers that GRC systems exist to support. November 2025 touched this twice.

Question 1 described an audit firm asked to help build a GRC system for an audit client, and the Question 3 solution recommended investing in GRC software to fix inter-company documentation.

CAMA 2020: the duties that GRC supports

GRC is not a legal requirement under CAMA 2020, but the Act creates the duties that GRC systems are built to meet. Note: this is an application of the sections, not a quotation. The full wording of each section is in the earlier topic on communication with those charged with governance.

The Financial Reporting Council of Nigeria (FRC) of Nigeria guidance on management’s report on internal control over financial reporting, covered in the earlier topic on investigations and internal control reports, adds the framework: Committee of Sponsoring Organizations of the Treadway Commission (COSO) is the preferred approach and management must keep documented evidence for its assessment. A GRC platform is one way to hold that evidence.

GRC software

Software that began as audit software has been upgraded into solutions for governance, risk and compliance. GRC is more than a software platform or set of tools. It is a broad framework that helps with decision-making, emergency preparedness and collaboration across all parts of an organisation.

Any organisation, of any size or industry, can benefit from a GRC strategy: it helps to improve performance, keep up to date with compliance and prevent and respond to threats.

Software helps organisations manage the documents and processes needed for productivity and disaster preparedness. Data privacy rules such as the Nigeria Data Protection Regulation and the Cybercrimes Act 2015 can be hard for businesses to navigate, and GRC tools can simplify and streamline compliance.

Popular platforms

• SAP GRC;
• Enablon GRC;
• Riskonnect GRC;
• RSA Archer GRC; and
• LogicManager GRC.

Choosing a GRC platform

1. ease of use;
2. support for mobile applications on multiple devices;
3. cloud-based delivery;
4. cost;
5. security;
6. 24-hour customer support; and
7. scalability and ease of integration.

Features of the best tools

1. content management;
2. document management;
3. risk analytics;
4. risk and control management;
5. workflow management;
6. audit management;
7. information security;
8. regulatory compliance management; and
9. dashboards and reporting.

COBIT

COBIT (Control Objectives for Information and Related Technologies) is an IT governance tool that has helped IT professionals to control information systems effectively. It links information technology and control practices, and consolidates and harmonises standards from prominent global sources into a resource for management and auditors. It is issued by ISACA and the IT Governance Institute. It applies to enterprise-wide information systems, including personal computers, mini-computers, mainframes and distributed processing.

It rests on the idea that IT resources need to be managed by a set of naturally grouped processes to provide the reliable information an organisation needs to achieve its objectives.

Purpose

COBIT gives management and business process owners an IT governance model that helps them understand and manage IT risks. It bridges the gaps between business risks, control needs and technical issues. It is a control model to meet the needs of IT governance and to ensure the integrity of information and information systems.

COBIT 2019 is a framework for the governance and management of enterprise information and technology, aimed at the whole enterprise.

Governance and management

In many enterprises, overall governance is the responsibility of the board of directors, under the chairperson. Specific governance duties may be delegated to management at an appropriate level, particularly in larger, complex enterprises. That fits the CAMA 2020 structure, where the board answers for the statements (s. 386(4)) and the audit committee oversees controls (s. 404(7)(d)).

COBIT 2019 publications

1. Introduction and methodology;
2. Governance and management objectives;
3. Design guide; and
4. Implementation guide.

Principles

COBIT 2019 rests on two sets of principles, those for a governance system and those for a governance framework.

Six principles for a governance system:

1. provide stakeholder value;
2. a holistic approach;
3. a dynamic governance system;
4. governance distinct from management;
5. tailored to enterprise needs; and
6. an end-to-end governance system.

Three principles for a governance framework:

1. based on a conceptual model;
2. open and flexible; and
3. aligned to major standards.

Components of the governance system

To meet its governance and management objectives, each enterprise builds, tailors and sustains a governance system from a number of components, formerly called enablers. They contribute individually and together to the good operation of the governance system over IT, and they interact with each other. The most familiar type is the process, but there are seven components.

The rules in more depth

Why the auditor looks at governance and not just controls

An IT control that works on the day of testing is of little comfort if nobody owns it. COBIT’s split between governance and management lets the auditor ask two questions: does the board set the direction and monitor it, and does management run the processes to deliver it. A weakness in the first is often the root cause of weaknesses in the second.

The earlier description of COBIT

COBIT is also described in the earlier topic on audit planning, using the older edition. For the exam, use this section, which follows COBIT 2019.

Independence when the auditor helps build the system

In November 2025 Question 1 the audit firm was asked to help develop GRC software for its listed audit client. Building a control system for a client and then auditing it creates a self-review threat, and taking on a management responsibility threatens independence. A large fee adds a dependence threat. Disclosure to those charged with governance does not remove the threat.

Section 406 of CAMA 2020 protects the auditor from pressure by management, but it does not settle whether the firm should take the work. The ethics topics earlier in the course give the safeguards and the cases where the firm should decline.

Worked example: choosing a platform and reading its output

Choosing. A bank board scores two platforms against five criteria. It weights security 30%, integration 25%, cost 20%, ease of use 15% and support 10%. Platform A scores 4, 3, 5, 4 and 3, and Platform B scores 5, 4, 3, 3 and 4 (out of 5). Weighted score for A is 0.30 × 4 + 0.25 × 3 + 0.20 × 5 + 0.15 × 4 + 0.10 × 3 = 1.20 + 0.75 + 1.00 + 0.60 + 0.30 = 3.85. For B it is 0.30 × 5 + 0.25 × 4 + 0.20 × 3 + 0.15 × 3 + 0.10 × 4 = 1.50 + 1.00 + 0.60 + 0.45 + 0.40 = 3.95.

B scores slightly higher because security carries the most weight. But the gap of 0.10 is small, so the board checks cost over three years and integration with its core system before deciding.

Reading the output. After a year, the platform shows that of 120 key controls, 96 passed testing, 14 have a design deficiency and 10 failed in operation. The pass rate is 96 ÷ 120 = 80%. The 24 failures are 20% of the total. The committee, acting under s. 404(7)(d), asks which of the 24 relate to financial reporting and which are significant. Three are over the approval of manual journals, and one is a management fraud indicator.

The CFO notes that, under the FRC guidance, an unremediated material weakness means management cannot conclude that internal control over financial reporting is effective, and that the s. 405 certification must be made with that in mind. The external auditor, who reads the dashboard as part of understanding the entity’s controls, then plans more substantive work on journals.

Mapping to COBIT. The journal approval failures are a process component weakness, the lack of a clear approver is an organisational structure weakness and the pressure to post quickly points to culture and behaviour. A fix that treats only the process leaves the other two.

How to score full marks

• Define GRC as a framework first, and software second.
• Link to the case. Say which of the features would solve the problem in the scenario.
• For COBIT, give governance and management separately. Evaluate, direct and monitor for governance. Plan, build, run and monitor for management.
• Count the principles and components. Six, three and seven.
• Add the CAMA 2020 link. Sections 404(7)(a), 404(7)(d) and 405.
• Remember independence if the auditor is asked to build the system.

Common mistakes in the exam

• Describing GRC software without explaining what GRC is.
• Mixing up the six principles of a governance system with the three principles of a governance framework.
• Saying COBIT is only for IT staff. It is aimed at the whole enterprise.
• Treating governance and management as the same thing.
• Forgetting that building a GRC system for an audit client threatens independence.
• Saying that CAMA 2020 requires GRC software. It sets the duties, and GRC supports them.

Quick revision

• GRC: a framework for decision-making, preparedness and collaboration. Software tools: SAP, Enablon, Riskonnect, RSA Archer, LogicManager.
• Choose by ease of use, mobile, cloud, cost, security, support, scalability and integration.
• COBIT 2019: four publications, six governance system principles, three framework principles, seven components.
• Governance: evaluate, direct, monitor. Management: plan, build, run, monitor.
• CAMA 2020: s. 404(7)(a) compliance, s. 404(7)(d) control review, s. 405 CEO and CFO certification.

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.